Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2

Hackers have begun actively exploiting a recently disclosed zero-day vulnerability in N-able's N-central platform, known as 4EverAble2Shell, to compromise servers and deploy cryptocurrency miners. Researchers have identified at least 21 affected systems, including 19 running the latest security update from the company. This development is significant as it highlights the critical nature of the flaw and the rapid pace at which threat actors are able to exploit vulnerabilities after their disclosure.

The 4EverAble2Shell exploit was disclosed by security researcher Sean Bales, who released proof-of-concept exploits for it and another vulnerability called Agent2Shell. These exploits allow attackers to execute commands with elevated privileges on N-central servers and Windows systems. N-central is a remote monitoring and management platform widely used by managed service providers (MSPs) and IT teams to oversee and secure customer devices and networks. The vulnerabilities were made public on November 12, just two days after N-able issued emergency updates to address previously disclosed flaws.

The attack chain leveraging 4EverAble2Shell involves exploiting an Apache Axis vulnerability, identified as CVE-2026-90436, which allows unauthenticated attackers to execute commands on vulnerable servers. This is combined with a separate privilege escalation weakness in N-central to gain root-level access. The exploitation requires the Legacy API functionality to be enabled, which is not the default setting. Despite the recent release of security patches, attackers have successfully compromised servers, indicating that the updates alone may not be sufficient.

The cybersecurity firm Previdian reported that attackers began probing for the 4EverAble2Shell vulnerability shortly after the proof-of-concept was released. The company observed suspicious activity targeting its N-central honeypot, with attackers attempting to execute the full exploit chain. This involved downloading a shell script from an attacker-controlled server to install a cryptocurrency miner, which was configured to use about half of the available CPU cores to avoid detection.

N-able has responded by implementing additional security measures, including restricting certain N-central features and integrations while developing further fixes. The company has advised on-premises customers to disable Legacy API access and to ensure their environments are not exposed to the public internet. Hosted environments have already had these protections applied. Despite these efforts, security researchers have confirmed successful exploitation of the vulnerability against production servers.

Exploiting such platforms can allow attackers to deploy malware across multiple systems, increasing the potential impact. This incident also highlights the challenges faced by vendors in rapidly addressing vulnerabilities and the need for organizations to be vigilant in applying security updates and configurations.

Remote code execution vulnerabilities like CVE-2026-90436 are particularly dangerous because they allow attackers to run arbitrary commands on a server without needing to authenticate. In this case, the exploitation chain leverages a flaw in the Apache Axis component used by N-central, which processes SOAP requests. By crafting malicious requests, attackers can execute commands as the 'nable' service account, and then escalate privileges to root, gaining full control over the server.